http://linux.die.net/man/3/fnmatch

Ah yes, I see : sounds to be the right function indeed. To be honnest
I'm not volunteering, but I promise will look at it.

> Netgroups are not supported in ldap_user_authorized_host either.
> So it will not work.

if pam_access support it (I think it does) it might work adding something
like this  : "account     required      pam_access.so"

in pam.d/system-auth

But doing that, I'll also need to remove  "ldap_access_order = host" in
sssd.conf and outsource HBAC to pam_access.

I'll test and let you know.

Best,

--
Olivier



2015-05-05 18:22 GMT+02:00 Lukas Slebodnik <lslebodn@redhat.com>:
On (05/05/15 18:10), Olivier wrote:
>Thank you Lukas,
>
>> >My question is : are jokers supported in the host attribute ?
>>
>> Answer is no.
>>
>> Although it shoudl not be difficult to implemennt it.
>> I would suggest to look into function sdap_access_host
>> in src/providers/ldap/sdap_access.c and function fnmatch
>> (or libpcre wich is already used by sssd)
>
>I think it's in function 'sdap_access_host', in the tests after
>host = (char *)el->values[i].data;
>
>I'm not a C expert but may use this :
I thought you volunteered to implement it.
I didn't noticed it's sssd-users list.


>http://www.gnu.org/software/libc/manual/html_node/POSIX-Regexp-Compilation.html
>http://www.gnu.org/software/libc/manual/html_node/Matching-POSIX-Regexps.htm
>

I meant
http://linux.die.net/man/3/fnmatch
http://www.pcre.org/original/doc/html/index.html

>But the whole testing process would need to be review to consider
>the whole host (except the potential starting '!' that still would need a
>specific
>process) as a regular expression : I suspect this not being as simple as
>that
>(for me at least).
>
>May be another way be to use a nis netgroup with pam_access and  to add a
>HBAC
Netgroups are not supported in ldap_user_authorized_host either.
So it will not work.

Currently ldap_user_authorized_host is very simple.
It does exactly what it is described in man page.

If someone want to use for different purpose then new features need to be
implemented. Patches are always welcomed.

According to git the author of this feature is
  commit 3612c73e7957721bcbf31d0118e2ac210eb46b88
  Author: Pierre Ossman <pierre@ossman.eu>
  Date:   Wed Dec 22 22:29:03 2010 +0100

    Add host access control support

    https://fedorahosted.org/sssd/ticket/746


LS
_______________________________________________
sssd-users mailing list
sssd-users@lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/sssd-users